feat(ui): canvas-first redesign with a self-hosted draw.io

The canvas now fills the window and the chat floats on its right. draw.io is
served from our own origin (public/drawio, downloaded at build time and
checked against the release's SHA-256), so the app can drive the editor
directly:

- every AI change becomes a version card with a thumbnail; compare, restore
  or undo it, and Ctrl+Z on the canvas takes an AI change back in one step
- shapes the AI just changed are highlighted on the canvas
- selected shapes appear as a chip and are sent to the model
- the app's own canvas toolbar, shape library and page tabs replace
  draw.io's chrome
- new start screen, session rename and switcher, open .drawio files
- settings split into Models & keys, Appearance, Advanced and About
- phones switch between canvas and chat
- dark mode keeps the diagram on a white sheet and no longer flashes

With an external draw.io (NEXT_PUBLIC_DRAWIO_BASE_URL) the app falls back to
draw.io's own toolbar and the features above that need same origin are off.

The chat logic moved from the 1500-line chat panel into a chat engine plus
small UI components; zustand holds canvas, versions, settings and UI state.

next.config.ts

@@ -4,12 +4,31 @@ import packageJson from "./package.json"
 const nextConfig: NextConfig = {
     /* config options here */
     output: "standalone",
+    // Keep the dev badge clear of the chat panel (right) and the page tabs
+    // (bottom left)
+    devIndicators: { position: "top-left" },
     // Support for subdirectory deployment (e.g., https://example.com/nextaidrawio)
     // Set NEXT_PUBLIC_BASE_PATH environment variable to your subdirectory path (e.g., /nextaidrawio)
     basePath: process.env.NEXT_PUBLIC_BASE_PATH || "",
     env: {
         APP_VERSION: packageJson.version,
     },
+    // The bundled draw.io shares the app's origin (and its stored keys):
+    // only the app may put it in a frame
+    async headers() {
+        return [
+            {
+                source: "/drawio/:path*",
+                headers: [
+                    {
+                        key: "Content-Security-Policy",
+                        value: "frame-ancestors 'self'",
+                    },
+                    { key: "X-Frame-Options", value: "SAMEORIGIN" },
+                ],
+            },
+        ]
+    },
     // Include instrumentation.ts in standalone build for Langfuse telemetry,
     // and the shape library docs get_shape_library reads at run time
     outputFileTracingIncludes: {